NTP: how every device gets to the same time
Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, you get a simulator in which you change it yourself.
TL;DR
NTP synchronizes clocks over UDP 123: the client sends a request, gets the server's time back and, from four timestamps, calculates its own offset and delay. The hierarchy is in levels (stratum): 0 the physical clock, 1 the server tied to it, then +1 at each level; 16 means unsynchronized. With 3–4 sources, the selection algorithms find the majority and exclude the wrong clocks (falsetickers); the correction is smooth below 128 ms and a jump above. On Cisco, a complete client has ntp server (three times), ntp source, ntp update-calendar, a time zone and timestamps in the logs; security comes from key authentication and from ntp access-group. Most incidents can be read in reach: 0 means transport, 377 without * means trust.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between platforms, daemons and standards. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.
The analogy, in short
Think of a town with a clock tower: the observatory has the true time, the tower takes it from there, the watchmakers from the tower, the shopkeepers from the watchmakers. Whoever can't see the tower sends a boy with a note and learns the time from the four moments written on it; whoever is smart asks three watchmakers and ignores the one who lies.
The model holds up to §8. From §9 on (PTP, VRFs, virtualization), it breaks; see the full analogy and its limits in §12.